In recent years, as network technologies develop rapidly, network security becomes particularly important. Generally, a decision-maker analyzes a current network security event in real time, so as to learn a current network security condition and dynamically assess a current network security situation. For a requirement on real-time quality of monitoring network security, the decision-maker usually pays attention to a recent overall network running situation, and does not care about historical data. In addition, network security events appear continuously and rapidly in a form of a data stream, and are characterized by real-time quality, a large data amount, a rapid change, and the like; and importance of data decreases gradually as time goes by. Therefore, to process an appearing event stream in time, a low-delay big data analysis engine is required. Based on this, a stream data multidimensional analysis (Stream On-Line Analytical Processing, hereinafter referred to as Stream OLAP) technology is developed, and the stream data multinational analysis technology is generally used for creating a stream data cube (Stream Cube) for all event streams in a time window, and on the stream cube, aggregating basic data from different dimensions and levels into high-dimensional data, so as to achieve an objective of multidimensional analysis. In a multidimensional model shown in FIG. 1, each dimension may include multiple levels, for example, a source Internet Protocol (source Internet Protocol, hereinafter referred to as source IP) dimension includes a source IP level, a source city (source city) level, a source province (source province) level, and a source country (source country) level. In FIG. 1, there are 1000 pieces of E1-type data whose IP is S1, there are 2000 pieces of El-type data whose IP is S2, both S1 and S2 are IPs in a C1 city, and then the number of pieces of the E1-type data in the C1 city is 3000. Then, all pieces of data whose IPs belong to the C1 city are aggregated to generate a data cube, that is, the number of E1-type network events counted from an IP level to a city level.
In the prior art, a single machine (a single physical machine) performs an aggregation operation on a received data stream to aggregate the data stream into data cubes of different levels (that is, data cubes of different structures). For example, data at an IP level may be aggregated to a City level to generate a data cube 1, or data at an IP level may be aggregated to a Province level to generate a data cube 2.
However, in the prior art, when a same data stream is aggregated into data cubes of different structures, computing time is excessively long.